A Workspace Administrator has full administrative control within their assigned Workspace. They manage users, groups, partners, folders, automations, remote servers, syncs, notifications, security keys, and data governance settings, all within the boundary of their Workspace.

The role gives a team, department, or project lead self-service control over a complete set of resources without involving the Site Administrator for day-to-day work. If you're choosing between Workspace Administrator and another admin role, see Comparing Workspace Administrators to Related Admin Roles at the bottom of this page.

What Workspace Administrators Can Manage

Workspace Administrators manage all resources within their Workspace on a self-service basis. They do not need to involve the Site Administrator for day-to-day operations.

User Management

Workspace Administrators handle the full user lifecycle within their Workspace: creating individual users, bulk creating users through CSV import, resetting passwords, disabling and re-enabling accounts, offboarding users, setting access expiration dates, configuring protocol privileges, managing IP whitelists, and creating user lifecycle rules to automatically disable or delete inactive accounts.

Group Management

Workspace Administrators create groups, update group memberships, and assign Group Admins within the Workspace.

Partner Management

Workspace Administrators onboard and offboard Partners, create and manage partner users, designate Partner Admins, and configure Partner Admin settings to control what Partner Admins can do within their Partner organization.

Folder and File Management

Workspace Administrators create folder structures and assign and manage folder permissions for users, groups, and partners. They designate Folder Admins for specific folders and apply folder settings such as watermark previews, folder locks, and file organization rules like rename on upload and organize files. They also configure data governance policies, including storage regions, retention policies like file expiration and archive/remove, and file restrictions such as extension limits, name length limits, and name regex limits.

Automations and Integrations

Workspace Administrators create and manage automations, remote servers, remote server mounts, and syncs. They can configure these only on folders within their Workspace. They cannot create automations, syncs, or mounts on folders outside their current Workspace.

Workspace Administrators create and manage share links, configure share link permissions and expiration, create inboxes for receiving files from external parties, set up share groups, create custom forms, and configure public hosting for Workspace folders.

Security Keys

Workspace Administrators create and manage SFTP/SSH keys and GPG keys for Workspace users, revoke keys, and apply key lifecycle rules to automatically expire or rotate keys.

AS2

Workspace Administrators create and manage AS2 identities, configure AS2 trading partners, and manage AS2 certificates for Workspace-level B2B file exchanges.

Notifications

Workspace Administrators create and manage email notifications, webhooks, Amazon SNS notifications, Google Pub/Sub notifications, Slack notifications, and Microsoft Teams notifications for events within the Workspace.

What Workspace Administrators Cannot Manage

Workspace Administrators do not have access to anything outside their Workspace. The following remain under the exclusive control of Site Administrators:

Site-wide security and protocol settings, including FTP, SFTP, and WebDAV configuration, ciphers, host keys, certificates, and 2FA requirements.
Authentication, including SSO provider integrations and site-wide authentication configuration.
Monitoring and logging, including SIEM integrations, site-level logs, and usage reporting.
Billing and site administration, including billing, Workspace creation, child site creation, and clickwraps.
Site customization and infrastructure, including custom domains, site branding, custom SMTP, and all other site-level customization.
Recovery and integrity, including restoring deleted files, folders, or users, and checksum and file integrity settings.

Workspace Administrators coordinate with the Site Administrator when they need changes to anything above. Common examples include troubleshooting failures that require access to site-level logs, updating 2FA requirements, configuring SSO, setting up SIEM integrations, adjusting protocol settings, restoring deleted files or users, and creating new Workspaces.

Delegating Administration Within a Workspace

Workspace Administrators can further delegate administration within their Workspace by assigning existing admin roles to Workspace users. Folder Admins manage folder settings and permissions for specific folders within the Workspace. Group Admins manage users within their assigned group inside the Workspace, drawing on whichever user-management capabilities the Site Administrator has enabled site-wide (create, edit, enable/disable, delete, set and reset passwords, and exempt from User Lifecycle Rules). Partner Admins manage users within their Partner organization inside the Workspace.

Delegation lets the Workspace Administrator distribute onboarding, offboarding, and day-to-day management responsibilities across their team without giving every user full Workspace administration.

The Workspace Administrator role fills a gap between existing administrative roles.

The Site Administrator can manage everything on the site, which is too broad for a team, department, or project lead.

The Folder Admin can manage a single folder's settings and permissions, which is too narrow for someone who needs to manage users, partners, and integrations.

The Group Admin can create users within their group but cannot manage them after creation.

The Partner Admin can manage users within their Partner organization but cannot manage folders, automations, or integrations.

The Workspace Administrator provides full operational control over a complete set of resources, scoped to a single Workspace.